Improper input validation in non‑secure callable veneer functions of the MCUXpresso SDK rpmsg‑lite multicore example allows a non‑secure caller to supply unvalidated pointers and buffer lengths. This flaw can read secure‑world memory into the non‑secure domain or trigger a denial of service, representing a medium‑severity confidentiality violation.

The vulnerability affects the NXP MCUXpresso SDK rpmsg‑lite multicore example, specifically releases up to 26.06.00‑lts and 26.09.00. Versions beginning with 26.06.01‑lts and 26.12.00‑pvw1 incorporate the fix.

The CVSS score of 6.8 places this issue in the medium–severity range, and the EPSS score is not available, indicating no known high exploitation probability. It is not listed in CISA KEV. The likely attack vector is local: any application executing in the non‑secure world of the same device could exploit the flaw by invoking the vulnerable NSC veneer functions with crafted parameters. The required conditions are that the non‑secure caller has the ability to call these functions, which is normally granted to co‑running applications on the same MCU. If the conditions are met, the attacker could gain read access to secure‑world memory and potentially crash the secure world, leading to loss of confidentiality or availability.